From 5f980702364422651ed08587cb0b0e815a87d222 Mon Sep 17 00:00:00 2001 From: Dave Thompson Date: Fri, 18 Sep 2026 09:02:36 -0400 Subject: [PATCH] chore(release): prepare v0.1.4 Changes: - move to Go 1.26.6 and YAML v3.0.5 - pin the Decernor consumer contract to v0.1.7 - update version and release documentation Generated by GPT-5.6 Sol via OpenCode under supervision of @3leapsdave Co-Authored-By: GPT-5.6 Sol Role: devlead Committer-of-Record: Dave Thompson [@3leapsdave] --- CHANGELOG.md | 15 ++++++- README.md | 4 +- RELEASE_CHECKLIST.md | 2 +- RELEASE_NOTES.md | 70 ++++++++++++++--------------- VERSION | 2 +- docs/decernor-pin.md | 10 ++--- docs/releases/v0.1.4.md | 57 +++++++++++++++++++++++ go.mod | 4 +- go.sum | 6 +-- internal/decernorloc/locate_test.go | 2 +- manifests/decernor-pin.json | 6 +-- 11 files changed, 121 insertions(+), 57 deletions(-) create mode 100644 docs/releases/v0.1.4.md diff --git a/CHANGELOG.md b/CHANGELOG.md index 3321f0f..9060328 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,18 @@ and this project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.ht ## [Unreleased] +## [0.1.4] - 2026-09-18 + +### Changed + +- The Decernor consumer contract now pins published `v0.1.7` at peeled commit + `70efa26`. Exact committed-synthetic fingerprint goldens remain byte-identical, + and generated-real checks remain transient. +- The Go directive moves from 1.26.4 to 1.26.6, clearing the applicable standard + library advisories reported against the prior toolchain. +- `go.yaml.in/yaml/v3` moves from v3.0.4 to v3.0.5. `edwards25519` remains at + v1.2.0. + ## [0.1.3] - 2026-08-25 ### Added @@ -110,7 +122,8 @@ and this project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.ht - The generator rejects Git worktrees and Git directories, stages output before publication, and restricts replacement to synthcorpus-owned directories. -[Unreleased]: https://github.com/3leaps/synthcorpus/compare/v0.1.3...HEAD +[Unreleased]: https://github.com/3leaps/synthcorpus/compare/v0.1.4...HEAD +[0.1.4]: https://github.com/3leaps/synthcorpus/releases/tag/v0.1.4 [0.1.3]: https://github.com/3leaps/synthcorpus/releases/tag/v0.1.3 [0.1.2]: https://github.com/3leaps/synthcorpus/releases/tag/v0.1.2 [0.1.1]: https://github.com/3leaps/synthcorpus/releases/tag/v0.1.1 diff --git a/README.md b/README.md index 1bca241..d029828 100644 --- a/README.md +++ b/README.md @@ -20,8 +20,8 @@ One-line: Synthetic, scanner-safe security-fixture corpus + throwaway-key genera | `cmd/synthcorpus-gen` | Generated-real mint (dogfooding roots only; never inside git) | | `cmd/synthcorpus-lexgen` | Lexical-mutation corpus generator (same never-inside-git rule) | | `docs/lexical-matrix.md` | Lexical-mutation matrix v1 — grammar, cells, floors, output planes | -| `manifests/decernor-pin.json` | Consumer pin for drift-check locate-by-binary (tagged decernor `v0.1.5`) | -| `docs/releases/` | Per-cut notes; current pack is [`v0.1.3`](docs/releases/v0.1.3.md) | +| `manifests/decernor-pin.json` | Consumer pin for drift-check locate-by-binary (tagged decernor `v0.1.7`) | +| `docs/releases/` | Per-cut notes; current pack is [`v0.1.4`](docs/releases/v0.1.4.md) | | `manifests/decernor-fingerprint-golden.json` | Deterministic committed-synthetic fingerprint contract | | `manifests/decernor-generated-real-properties.json` | Property-only generated-real contract (no exact random values) | | `AGENTS.md` | Agent guide — **safety header first** | diff --git a/RELEASE_CHECKLIST.md b/RELEASE_CHECKLIST.md index 3bac347..7292716 100644 --- a/RELEASE_CHECKLIST.md +++ b/RELEASE_CHECKLIST.md @@ -217,6 +217,6 @@ ceremony. - [ ] Confirm the tag and GitHub release resolve to the intended `main` commit. - [ ] Confirm the three required checks remain green on that commit. -- [ ] Verify `[Unreleased]` in `CHANGELOG.md` starts from `v0.1.3`. +- [ ] Verify `[Unreleased]` in `CHANGELOG.md` starts from `v0.1.4`. - [ ] Keep only the three most recent entries in `RELEASE_NOTES.md`; retain the complete per-release narrative under `docs/releases/`. diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md index b5c8c2c..b2cfb5e 100644 --- a/RELEASE_NOTES.md +++ b/RELEASE_NOTES.md @@ -4,6 +4,39 @@ This file contains release notes for up to the three most recent releases in rev --- +## v0.1.4 (2026-09-18) + +**Patched Go baseline and Decernor v0.1.7 consumer pin** + +synthcorpus v0.1.4 moves to Go 1.26.6, updates YAML to v3.0.5, and pins the +Decernor consumer contract to published `v0.1.7` at peeled commit `70efa26`. +The corpus, schemas, and expected fingerprint records are unchanged. + +### Highlights + +- **Decernor consumer pin is tagged `v0.1.7`.** Exact committed-synthetic + goldens remain byte-identical; generated-real checks remain transient. Locate + remains an absolute `DECERNOR_BIN` or `PATH` lookup. +- **Go 1.26.6** clears the standard-library advisories applicable to the prior + Go 1.26.4 baseline. +- **YAML v3.0.5** provides the available direct dependency patch; + `edwards25519` remains at v1.2.0. +- Repository and both generators report version `0.1.4`. Releases remain + GPG-signed tags plus notes, with zero uploaded assets. + +### Governing invariant + +Generated-real material never enters the repository. Only registered, +provably unusable committed-synthetic specimens live under `fixtures/`. + +### Compatibility + +No migration is required. Consumer contract callers must supply a Decernor +binary satisfying `manifests/decernor-pin.json` (`v0.1.7` / `70efa26`). + +See [docs/releases/v0.1.4.md](docs/releases/v0.1.4.md) for the complete release +narrative. + ## v0.1.3 (2026-08-25) **Decernor v0.1.5 pin and public baseline** @@ -69,40 +102,3 @@ for that cut. See [docs/releases/v0.1.2.md](docs/releases/v0.1.2.md) for the complete release narrative. - -## v0.1.1 (2026-08-20) - -**Lexical lane and tagged Decernor pin** - -synthcorpus v0.1.1 adds a second generator lane for deterministic -lexical-mutation corpora and pins the Decernor consumer contract to tagged -`v0.1.4`. Generated-real material still never enters Git. - -### Highlights - -- **Lexical-mutation corpus generator.** `synthcorpus-lexgen` emits a 49-cell - matrix of visibly synthetic terms (`zzlx` plus a seed-derived body) with - sterile and protected output planes. Population floors and generation-time - guards fail the run rather than emit a thin or colliding corpus. -- **Decernor consumer pin is tagged `v0.1.4`.** Exact committed-synthetic - fingerprint goldens track that binary. Locate remains `DECERNOR_BIN` / PATH. - Fingerprint output is unchanged from the prior tagged cut; goldens are not - rewritten. -- **Per-generator ownership markers.** Each generator owns a distinct marker - file and kind so `--force` can only replace a root its own lane created. -- Repository and generator report version `0.1.1`. Releases remain signed tags - plus notes, with no prebuilt generator binary or attached corpus bundle. - -### Governing invariant - -Generated-real material never enters the repository. Only registered, -provably unusable committed-synthetic specimens live under `fixtures/`. - -### Compatibility - -No migration is required. The generator remains a repository-local dogfooding -tool and is not distributed. Consumer contract callers must supply a Decernor -binary that satisfies `manifests/decernor-pin.json` (`v0.1.4` / `32d0176`). - -See [docs/releases/v0.1.1.md](docs/releases/v0.1.1.md) for the complete release -narrative. diff --git a/VERSION b/VERSION index b1e80bb..845639e 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -0.1.3 +0.1.4 diff --git a/docs/decernor-pin.md b/docs/decernor-pin.md index 793c08c..5833073 100644 --- a/docs/decernor-pin.md +++ b/docs/decernor-pin.md @@ -8,9 +8,9 @@ worktree path, never a Go module import from decernor into synthcorpus. | Field | Value | |-------|-------| | Source | https://github.com/3leaps/decernor | -| Min version | `0.1.5` | -| Preferred tag | `v0.1.5` | -| Preferred commit | `5dfd574` (object named by the tag; GPG-primary contract token and hex minisign blob SHA) | +| Min version | `0.1.7` | +| Preferred tag | `v0.1.7` | +| Preferred commit | `70efa26` (commit peeled from the annotated tag; fingerprint contracts remain separate) | | Machine pin file | [`manifests/decernor-pin.json`](../manifests/decernor-pin.json) | The **tag** is the locate contract. `preferred_commit` records the tagged @@ -28,8 +28,8 @@ Verify identity with extended version output (never parse secret material): ```sh "$DECERNOR_BIN" version -e -# Version: 0.1.5 -# Commit: 5dfd574 +# Version: 0.1.7 +# Commit: 70efa26 ``` Package helper: `internal/decernorloc` (`Locate`, `ReadIdentity`, `CheckPin`). diff --git a/docs/releases/v0.1.4.md b/docs/releases/v0.1.4.md new file mode 100644 index 0000000..d597a34 --- /dev/null +++ b/docs/releases/v0.1.4.md @@ -0,0 +1,57 @@ +# synthcorpus v0.1.4 Release Notes + +**Release date:** 2026-09-18 + +## Summary + +**Patched Go baseline and Decernor v0.1.7 consumer pin** + +synthcorpus v0.1.4 moves to Go 1.26.6, updates the YAML dependency to v3.0.5, +and pins the Decernor consumer contract to published `v0.1.7`. The corpus, +schemas, expected fingerprint records, and generated-real boundary are +unchanged. + +## Highlights + +- **Decernor consumer pin is tagged `v0.1.7`.** Machine pin and docs name + `min_version` `0.1.7`, `preferred_tag` `v0.1.7`, and peeled commit `70efa26`. + Exact committed-synthetic fingerprint goldens remain byte-identical. Locate + remains an absolute `DECERNOR_BIN` or `PATH` lookup. +- **Go 1.26.6.** The patched standard library clears the advisories applicable + to the previous Go 1.26.4 baseline. +- **YAML v3.0.5.** The direct YAML dependency receives its patch update; + `edwards25519` remains at v1.2.0. +- Repository and both generators report version `0.1.4`. + +## Governing invariant + +Generated-real material never enters the repository. Only registered, +provably unusable committed-synthetic specimens live under `fixtures/`. + +## Decernor contract + +The consumer pin is tagged Decernor `v0.1.7` (`70efa26`). Exact goldens are +unchanged from the prior pin. Generated-real checks validate properties only in +an isolated output root and retain no generated key material or fingerprints. + +## Verification + +- `GOTOOLCHAIN=go1.26.6 go run golang.org/x/vuln/cmd/govulncheck@v1.8.0 ./...` + reports no symbol-, package-, or module-level vulnerabilities. +- `DECERNOR_BIN=/absolute/path/to/decernor make check-all` runs formatting, + tests, build, scanner canaries, negative-crypto proofs, release controls, and + both consumer-contract lanes. +- Dependency licenses pass the existing high-severity assessment. + +## Compatibility + +No migration is required. Consumer contract callers must supply a Decernor +binary satisfying `manifests/decernor-pin.json` (`v0.1.7` / `70efa26`). + +## Release vehicle + +v0.1.4 is a GPG-signed Git tag plus GitHub release notes. GitHub's automatic +source archives are expected. No prebuilt generator binary, package-manager +artifact, separately attached corpus bundle, artifact signature or key, +checksum manifest, or provenance asset is published. Generated-real material +is not part of the source tree or release. diff --git a/go.mod b/go.mod index 6a887a9..1b2e2e1 100644 --- a/go.mod +++ b/go.mod @@ -1,8 +1,8 @@ module github.com/3leaps/synthcorpus -go 1.26.4 +go 1.26.6 require ( filippo.io/edwards25519 v1.2.0 - go.yaml.in/yaml/v3 v3.0.4 + go.yaml.in/yaml/v3 v3.0.5 ) diff --git a/go.sum b/go.sum index b26ed01..25a1ce6 100644 --- a/go.sum +++ b/go.sum @@ -1,6 +1,4 @@ filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo= filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc= -go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= -go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= -gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM= -gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= +go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= diff --git a/internal/decernorloc/locate_test.go b/internal/decernorloc/locate_test.go index 0ec0230..bbda232 100644 --- a/internal/decernorloc/locate_test.go +++ b/internal/decernorloc/locate_test.go @@ -72,7 +72,7 @@ func TestLoadPinRoundTrip(t *testing.T) { if err != nil { t.Fatal(err) } - if pin.MinVersion != "0.1.5" || pin.PreferredTag != "v0.1.5" || pin.PreferredCommit != "5dfd574" { + if pin.MinVersion != "0.1.7" || pin.PreferredTag != "v0.1.7" || pin.PreferredCommit != "70efa26" { t.Fatalf("pin = %#v", pin) } if pin.Locate.Env != EnvBinary { diff --git a/manifests/decernor-pin.json b/manifests/decernor-pin.json index fac8833..6f0b6b9 100644 --- a/manifests/decernor-pin.json +++ b/manifests/decernor-pin.json @@ -3,9 +3,9 @@ "kind": "synthcorpus-decernor-pin", "consumer": "synthcorpus", "tool": "decernor", - "min_version": "0.1.5", - "preferred_tag": "v0.1.5", - "preferred_commit": "5dfd574", + "min_version": "0.1.7", + "preferred_tag": "v0.1.7", + "preferred_commit": "70efa26", "source_repo": "https://github.com/3leaps/decernor", "locate": { "env": "DECERNOR_BIN",